Mtolley

A stored cross-site scripting issue exists in the HighlightCode component. The component renders unescaped file content before the highlight.js library finishes loading. Authenticated attackers can upload text files containing HTML or JavaScript payloads that execute in the browsers of users who view the files. This can allow unauthorized API calls, such as modifying account details on behalf of the victim.

Pdfminer.six is a tool for extracting information from PDF documents. Prior to version 20251107, the software could execute arbitrary code from a malicious pickle file when processing a malicious PDF. The `CMapDB. load data()` function uses `pickle.loads()` to deserialize pickle files. A malicious PDF can specify an alternative directory and filename ending in `.pickle.gz`, allowing a malicious, zipped pickle file to contain code that automatically executes when the PDF is processed.